LastPass appears to be holding users' passwords hostage (opens in new tab)

Fwiw, most good password managers don’t necessarily let the business know your passwords, the passwords are encrypted before transport, and the business has no access to your data. All decryption can be client side only. You pay for storage and hosting of encrypted data, i.e., access from anywhere, and browser+mobile apps.

This means losing the master password is dangerous, so some people still choose to allow a host-side override where the business has some access, in order to enable account recovery in the case of a lost password.

How do you manage your credentials then? Before using a password manager, the best thing I could manage was variations on a similar password. But sites with arcane password requirements tend to break this.

I was _really_ disappointed when 1password dropped support for Dropbox sync and pushed everyone onto their storage. I'm uncomfortable, like you, with the truly single point of failure this way: I would much rather diffuse the storage and master credentials to separate parties.

What's your alternative? If it's just memorizing a huge set of passwords plus the ability to add to that set whenever you need, that's awesome.

But if you're doing what most people do instead of a password manager, which is just re-use two or three passwords for everything, then you don't just have a single point of failure. You have dozens of points of failure. You're not letting "a business" know all your passwords, you're letting many businesses know your password, singular.

Also, password managers don't only come from "businesses". I use pass[0], which just gpg encrypts passwords in a git repo. If you're willing to set up sshd, git, and gpg on your devices, you can use pass.

That said I still recommend that people coming from the "old way" use something like 1Password or LastPass if self-hosted is not for them. I share your distaste for giving the keys to the kingdom to a single business, but it's better than the alternative. I trust LastPass more than I trust the weakest member among a random set of other businesses.

0. https://www.passwordstore.org/

> let a business know all my passwords

You don't. Password managers like Bitwarden are basically cloud storage for an encrypted blob that happens to contain your passwords wrapped up with a nice UI/UX and handle all the syncing for you between your devices. They don't "know" your passwords. They sync that blob and then all encryption and decryption is done on your device.

Not to mention with Bitwarden you can run your own server if you are comfortable doing so and don't want to rely on their servers.

> making it my single point of failure

So maintain backups of your encrypted vault. Also Bitwarden (which is what I use) doesn't require an internet connection to unlock your vault so even if you're stuck somewhere with no net access you can still access all your data. Export it, etc. It is 100% offline for use, internet connection is only needed to sync the encrypted blob.

---

IMHO the benefits of a good password manager with nicely integrated password management, history, generation, MFA, etc. far outweigh the drawbacks of your account being hacked.

I have over 300 logins in my password manager.

I only have to remember a few actually important passwords in my brain which makes life exponentially easier when logging in to so many different services each day.

The reality is that it's unreasonable to expect users to maintain passwords that are both unique and memorable. My password manager tells me I have over 400 credentials saved. There's no way I can keep track of that in my head.

To solve this, you can drop either one of the "memorability" or "uniqueness" requirements. Most people naturally drop "uniquness" and reuse the same passwords everywhere. Or you can use a password manager and drop the "memorability" requirement. It's safer and more usable to do the latter. Even writing it down in a physical notebook is an improvement over reusing the same password.

I highly recommend keepass + syncthing. Avoid some third party having access to your password store while keeping it backed up wherever you need it to be.

I'll never use a centralized one like that. I use a password manager that keeps my vault file locally and is synchronized through any cloud storage provider of my choice. I chose OneDrive, but if I was more insistent on absolute privacy it could also synchronize to a WebDAV server I set up myself.

I feel that way about online password managers, but an offline open source password manager is a huge quality of life (not to mention security) improvement when all of your accounts have different passwords. I'd highly recommend giving it a shot.

It’s just terribly insecure. Humans are really bad at making unique passwords. I have around 500 unique passwords in my password manager. No way I could do that manually.

>while also making it my single point of failure

This is my concern as well. The whole idea of my passwords being in a black box that is tied to my hardware seems like a recipe for disaster if I am traveling and my hardware gets stolen, lost or destroyed.

(maybe there is something that I am failing to understand, but I've watched several videos that attempt to explain how a PW manager works and I've not found an answer)

You don't need to let a business know anything. Run your own self-hosted instance via a dedicated server or WebDAV, or use the password database totally offline. SaaS is not the only option here (and IMO, I wouldn't even consider using a password manager unless I could do so without involving any other companies).

I'm afraid you don't understand how password managers work then. You do not reveal your passwords to LastPass, and used properly it is not a SPOF.

That said, the model is generally broken and LastPass is near the bottom of the heap.

It sounds like a cloud hosted password manager isn't a good choice for you. However not all password managers are cut from the same cloth. There are many offline/locally encrypted options.

Thank you.

If you or they are not technically inclined, write them down on a piece of paper, stored safely.

If you are, encrypt a file or volume on your computer and use that.

I've done and advised this forever and each little story like this leaves me convinced that these ways, while not perfect, definitely beat all the others.

You gotta balance. Don't use a password manager for you key accounts - use it for all the rest that you sign up for.

Use one that stores locally and never shares the data with anyone.

I've been on 1Password for many many years - looks like I bought it first in 2008, and I've bought every major version since, and then moved to subscription within weeks of it launching. I couldn't be happier with the product, or their customer support. $3 per month for bulletproof password management that integrates so well into iOS and Mac OS isn't even something I think about when renewal time comes along. I'm watching their move to Electron for their apps with caution, but they have such a long track record of shipping great product that I'm not too worried.

I'm using keepassxc, synchronized over pcloud (but Box, Dropbox, gdrive etc would all work just as well). There's an excellent browser plugin, I use keepass2android on my phone and it also functions as my ssh-agent and I use it as my secret-provider for my Linux desktop (essentially a replacement for gnome keyring or kwallet). I'm not sure what reason there would be to use a SAAS.

I’ve used 1Password for around 8 years (maybe longer) and I believe them to be a pretty safe bet currently.

I wasn’t a huge fan of their move to a hosted model but I went with it and even so, I have to say that their service is good, reliable and instilling of confidence.

If I was starting from scratch I’d probably look more closely at Bitwarden (likely to use their hosted service but knowing I have the option later to self-host).

I would suggest that most people would likely be served well by either of these solutions at this point in time.

I've been using pen & paper for a decade. So far it has not been affected by any CVEs, company acquisitions, bugs, quirky updates, outages, mandatory subscriptions or arbitrary account limits, leaks, or other compromises. It's airgapped and works fully offline too. Even if all my computing devices got filled with malware, they would only log the passwords that I actually type in.

bitwarden seems to be the favorite so far - open source, self-hostable if needed, and pretty easy to use.

There's a free reimplementation of its server which also seems to be highly recommended:

https://github.com/dani-garcia/vaultwarden

I am having a great experience with KeepassXC and KeepassXC-browser. I sync my password database via Seafile, which is hosted by Your Secure Cloud. And I use Strongbox on iOS.

BitWarden. Have been using for 3+ years now (Prior used LastPass).

BitWarden:

* Open-Source

* Affordable pricing

* Good, working browser extensions and desktop app

I used LastPass for a while too, but I then switched to KeePass, using syncthings to have a single db. At first that was great, but after a few save mistakes, and a slight change in need, I've switched to a hosted bitwarden (using vaultwarden).

I've not had a single issue with it since, it's fully compatible with the official bitwarden app (which works rather well), and is much easier to use when other people in your household also need to manage their passwords.

Point of note : the android app syncs the database locally, and can be accessed/used/exported even offline, which is very, very reassuring in case of server/network failure

I use KeyPass and then several different UI’s, based on the platform. I store the KeyPass in my favorite cloud drive so I can use it from wherever.

If you're going to be paying a subscription anyway, I've been using 1Password for 2.5ish years pretty successfully.

It's also recommended by Troy Hunt, who has a reputation at stake in all of this, since he runs stuff like https://haveibeenpwned.com

Former LastPass user (2+ years) and current 1Password user (2+ years).

There’s no looking back. LastPass was buggy and the UI ugly. That was fine when it was free but when they went to fee based for cross platform support we switched the whole family over to LastPass. Everything works, is pleasant to use, and no slimy tactics.

Another vote for BitWarden. I used LastPass for many years, and jumped ship when they were acquired. I've been using Bitwarden for a few years now and really like it.

Importing from LastPass was easy.

I have quite a few gripes with Bitwarden, but I've never used LastPass so don't take this as a comparison.

1. Their auditing ("Event Logs") feature is unusable. It refers to items by some magical identifier which does not correspond to the name in the vault, e.g. "Viewed password for item ebabefac".

2. Payments by anything other than Credit Card are a mess, which is a serious pain if you have a lot of users. It took us weeks and many support interactions to get something as trivial as a bank transfer sorted.

3. It's still (!) lacking a feature to actually send people passwords ... as in sysadmin creates some account for a user, presses a magical button in BW, and it ends up in the user's vault (or maybe they get a message and are asked to import it, whatever). BW recommends you use the "Send" feature, which is basically a glorified pastebin.

4. The UX is .... not great. Organization vs Personal Collection view is confusing. Every time we onboard a new user we get questions about how they should store personal passwords.

It works well enough, but I don't think the enterprise plan is worth the 60/user/year price tag.

I switched to BitWarden when they dropped the subscription requirement for mobile, continued charging for my subscription for over a year and then announced they’d start charging again.

It’s… fine, but many areas of integration with browser and on iOS are significantly less polished and pleasant to use. Things like credit cards are entirely manual on iOS. It’s definitely a worse experience on the convenience side.

That, and even though it’s relatively easy to migrate, it’s even easier to not spend the effort reworking your workflows and ways you use password tools.

“Totally free” is not a benefit. I want a transactional relationship with a company that will compel them to help me when things go wrong.

Here is my reason, at least: https://community.bitwarden.com/t/custom-fields-and-automati...

LastPass has been around for a very long time. I'm still using it because I haven't had much reason to migrate and I installed it probably a decade or more ago.

Lack of information. LastPass was also relatively decent software for a while. I only stopped using it two years ago, but also noticed at the time that they have significant marketing efforts compared to the competition.

It seems like LastPass is angling to become the AOL of password managers, and by that I mean they want a bunch of old customers who never bother to switch to something better.

At any rate there is no reason to use LastPass. There must be tens of password managers all geared towards a different kind of user and all better than LastPass.

You can also grab a raspberry pi and self host.

I use Keepass + Onedrive sync (Windows + Android). It's been working well for many many years and I see no reason to switch.

If I had to recommend a pw manager to someone I'd probably suggest they just save them in-browser, and use the same browser (Chrome/FF/Edge) across all their devices. Chrome has a pretty good password suggestion feature. Other browsers are probably not far behind.

The last time I checked, Bitwarden would fill a password into an iframe even if the iframe is for a different domain than the parent. This came up in one of their security audits and changing it was argued against.

This has security implications and what cautioned me against it.

Other password managers don't do this and look at iframe domains before filling them in.

Am I missing something?

I use pass. The provided password manager in linux. passmenu provides a great workflow for inputting the passwords.

Something that I believe should be added to this thread would be utilities that can take the LastPass export and transform it into structures that other pw managers can easily recognize and import.

Here [1] is an example of migrating passwords from LastPass to KeePassXC. Does anyone have more examples like this for other pw managers?

[1] - https://blog.paranoidpenguin.net/2018/12/migrating-from-last...

KeePass and pass use fully open database formats. (I like MacPass, KeePassHTTP Connector, and Keepassium.) Enpass uses a well-documented database format based on SQLCipher/SQLite (albeit not fully open, you have to piece it together from the white paper and forum posts). They are all local-first, so you own your password information.

I have no reason to believe BitWarden would try to hold my passwords hostage. But I prefer the solution where they can't.

Gonna put a vote in for KeepassXC (and in general the Keepass family of local-first PW managers).

You get full control over how to handle multi-device synchronization because it doesn't attempt to do this at all...

Do you have experience with it working on android? It seems Lastpass is only semi reliable with how android allows auotfilling fields in.

i especially recommend vaultwarden, the community developed self hosted backed.

I moved to Bitwarden. Solid choice, as well.

1Password is another proprietary SaaS password manager. You "dodged this bullet" but shouldn't you also be concerned that 1P will do the same thing in the future?

I moved to 1PW after the first LastPass leak, was the best decision I ever made.

My girlfriend has been using 1Password for years without any issue, so I think it must be a decent service, at least in her book. The built-in password management on iOS and macOS has been good enough for me, though.

1Password is moving in a direction just as bad. A few months ago they took away features for legacy single paid users and started hiding them behind the monthly paywall.

Doing the same was on my TODO list for a long time, and I just migrated a couple of weeks ago. Very glad I finally got around to it!

Confirmed broken. CSV file contained barely a dozen entries. Real list is hundreds.

I guess Bitwarden secured itself a test-run.

edit: for clarity, the downloaded csv was defective, the csv shown seems complete. This is a problem

The problem is if you aren't a paying customer, and you are locked to the mobile app, it doesn't have the password CSV option. So if you can access the desktop web option, sure, it works. But that's not true for all users.

Have you checked this thing I commented? Just to know if it's just a personal problem or it is global: https://news.ycombinator.com/item?id=29896882

I don't pay for lastpass, and I was able to export, but I've also been a user for a LONG time, so perhaps grandfathered in.

I pay for LastPass Premium and it exports just fine in the latest Chrome on Windows 10 x64.

The older (and busier) I get, the more I'm willing to put up with a walled garden that just works.

Apple is not (always) a good actor; they've been caught intentionally degrading the performance of older hardware, in order to increase sales of new hardware. But, they seem very keen on maintaining the privacy and safety of their users, which is true of essentially no other tech company on the planet.

I'm still not all-in on the Apple ecosystem, but stuff like this always makes me pause.

Strange - the fact that Apple is not trying to make money from passwords seems like a good reason NOT to use it. Though I don't have much experience with keychain so I can't comment on that specifically. (I do have a lot of Apple devices I like though).

I feel more comfortable when a company is trying to earn my money by delivering a good product with good service. Of course that doesn't always work out, but I feel it's a better shot.

Can you share passwords with iCloud Keychain? I ask because I heavily use the family vaulting in 1PW to share common passwords amongst family.

A solution that isn't cross-platform at all. Non-starter for me.

I usually use this website to find companies' phone numbers: https://gethuman.com/phone-number/LastPass

It tells you that it is a credit monitoring service when you call, but it is indeed the password manager service....

800-830-6680 and then press 3 (the other 2 options disconnect you)

While it was harder than it should have been to reach them. The one support interaction I’ve ever needed to have with them (domain name change went badly with master password email account re-verification before I added a secondary email) was amazing. They had a thorough security checking, identification confirmation process that would make it more difficult for social engineering, they were able to fix up the email over the course of a 45 minute phone call (I did mention it was thorough)

I vaguely remember eventually figuring out how to lodge some kind of issue or something because the UI of their credit monitoring was completely broken. It was impossible to use the service at all.

I think I eventually figured out some methodology of opening some graphical element in a new frame or something that got it working partially but that was what made me cancel everything and switch to BitWarden. Ridiculous.

Ah, the Jagex method.

Possibly in order to prevent social engineering they have simply sought to make it impossible.

I wanted to use BW. Even had a talk with their lead engineer and CEO about switching my company over. Seems like a good product but at least two years ago their commercial offering was abysmal, basically no way to run a managed system with user accounts for their personal things and work entires that I could control or deploy.

Lastpass Enterprise has issues, but it does allow the above.

The only thing important about a password manager is the amount of the bug bounty. In economic theory, it should be higher than the assets you protect with the password manager.

> This company is so rotten. Just look at their recent track record showing pure user hostility. Why is anyone still using them?

Inertia. Lastpass still works, and frankly it's not high on my list of priorities to research and switch to a new password manager. Some people have time to obsess over this stuff, I don't anymore.

And frankly, data export barriers wouldn't be a difficulty for me (I wouldn't mind re-keying stuff if that's what it took, and that's what I did to get my passwords into LastPass). Deciding on a direction is way more work, and that's the real barrier.

Also, it's kind of pointless. The alternatives will almost certainty be some open source thing with major UX friction and personal maintenance burden, or some for-profit service that will eventually be corrupted in exactly the same way as LastPass has.

> Just look at their recent track record showing pure user hostility. Why is anyone still using them?

Because I've managed to miss any news damning enough to make me decide to switch.

It's possible that either:

a) I've overlooked something

b) You and I have different priorities

c) You're being hyperbolic.

I genuinely don't know which but your phrasing and tone makes me lean towards (c)

The internet is full of people shouting "God. [Company] is the worst!" - if you want to be persuasive then it's probably better to not sound like them.

Probably because they make it hard enough to leave so that the majority of end-users just swallow the pill

I use a password manager(Bitwarden) to:

1. avoid vendor lockin (if I want to switch browsers I can, or switch from iOS to Android) 2. enable portability, with passwords not just being available locally requiring manual migration to other devices

Do you have problems/qualms with the above just using browser password managers?

Isn't this difficult to manage passwords in apps other than a browser though? Plus, I use 1Password to store other sensitive data like SSN etc.

Here's a hint: non-compliance is basically a finger wag, perhaps a slap on the wrist in the most extreme case.

How is 1Password more trustworthy than opensource and "audited" Bitwarden?

If they're storing the encrypted data on your behalf then they should be able to provide that, plus instructions how to decrypt it.

The reddit post specifically mentions this

>- Only making the export function available via the desktop browser plugin, despite locking peoples accounts to either Desktop or Mobile after 3 switches between these platforms.

I did this a few months ago and didn't run into that problem. I basically did a "make before break" migration. I kept LastPass available for several months after importing the database into 1Password, while using 1Password day to day. I never needed to refer to LastPass, so I finally unsubscribed and deleted my account.

I have read some others on HN describe stories where it didn't go so well. Private Notes not exported (I saw this on HN before I cancelled, but mine all came over), incomplete exports (I got everything), etc.

But yeah... do be careful and give yourself a grace period.

I had ten years prepaid premium on LastPass, being an early adopter (it was a good product and a good price at the time).

After they were acquired, LogMeIn was quite happy to charge my credit card for the premium service, for several years running. Never did get a refund.

The complaint page for the UK's national data protection authority, ICO: https://ico.org.uk/make-a-complaint/your-personal-informatio...

The contact page for the California Privacy Protection Agency: https://cppa.ca.gov/about_us/contact.html

The contact info for the national data protection authorities in the EU, Iceland, Liechtenstein, and Norway is linked at [2] in the comment above.

If you used the same email account I think that's expected behavior.

> All it takes is for someone to write a little chrome extension to export everything and import it into competing software...

Though it would be foolish to trust such an extension, given the existence of practices like extension hijacking. I'm sure someone could make a lot of money with a "secretly export LastPass passwords to attacker" extension.